CVE-2026-91841: NetworkManager-vpnc Privilege Escalation

CVE-2026-91841 Overview

A flaw in NetworkManager-vpnc, a Virtual Private Network (VPN) plugin for NetworkManager, allows local unprivileged users to escalate privileges to root. The vulnerability stems from improper neutralization of newline characters [CWE-93] in the CA-File path parameter. An attacker who injects a newline into this field can smuggle additional configuration directives into the vpnc helper, resulting in arbitrary command execution with root privileges. The issue is tracked by Red Hat and GNOME upstream and affects Linux systems that use the NetworkManager-vpnc plugin to manage Cisco-compatible VPN connections.

Critical Impact
Local unprivileged users can achieve full root code execution on affected Linux hosts by submitting a crafted CA-File path to the NetworkManager-vpnc plugin.

Affected Products

NetworkManager-vpnc (GNOME NetworkManager VPN plugin for vpnc)
Red Hat Enterprise Linux distributions shipping NetworkManager-vpnc
Linux distributions packaging the upstream GNOME NetworkManager-vpnc plugin

Discovery Timeline

2026-09-25 - CVE-2026-91841 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-91841

Vulnerability Analysis

NetworkManager-vpnc translates connection settings from NetworkManager into a configuration stream consumed by the privileged vpnc helper. The plugin runs with elevated privileges through a D-Bus service so that unprivileged desktop users can bring VPN tunnels up and down. When the plugin builds the vpnc configuration, it accepts the CA-File path from user-controlled connection properties without stripping line terminators.

Because the vpnc configuration format is line-oriented, an attacker who embeds a newline inside the CA-File value can append arbitrary directives to the configuration passed to the helper. One of those directives can invoke an attacker-controlled script, which then executes as root. This is a classic CRLF-style injection pattern [CWE-93] applied to a privileged configuration parser rather than an HTTP response.

Exploitation requires local access and the ability to create or modify a NetworkManager VPN connection profile, which many desktop Linux systems permit for logged-in users through PolicyKit.

Root Cause

The root cause is improper neutralization of CRLF sequences in the CA-File connection property before it is written into the vpnc configuration stream. The plugin trusts the string as a filesystem path and does not validate that it contains a single line.

Attack Vector

The attack vector is local. A low-privileged user crafts a VPN connection where the CA-File field contains a path followed by a newline and additional vpnc directives that trigger command execution. Activating the VPN connection causes the privileged NetworkManager-vpnc service to process the injected directives as root.

No verified public proof-of-concept code is referenced in the advisory. See the Red Hat CVE-2026-91841 advisory and the GNOME NetworkManager-vpnc Work Item for upstream analysis.

Detection Methods for CVE-2026-91841

Indicators of Compromise

NetworkManager connection profiles in /etc/NetworkManager/system-connections/ or user keyfiles containing newline characters or unexpected vpnc directives inside the ca-file property.
Unexpected child processes of nm-vpnc-service or vpnc running as root, especially shells or interpreters such as bash, sh, python, or perl.
Audit records showing non-root users creating or modifying VPN connections immediately before root-level command execution.

Detection Strategies

Parse NetworkManager VPN keyfiles and D-Bus AddConnection payloads for CA-File values containing \n, \r, or additional vpnc keywords such as Script or IPSec.
Alert on process lineage where NetworkManager or nm-vpnc-service spawns an interactive shell or scripting interpreter.
Correlate PolicyKit authorizations for org.freedesktop.NetworkManager.settings.modify.* with subsequent root process creation events.

Monitoring Recommendations

Enable Linux auditd rules on /etc/NetworkManager/system-connections/ and user-scoped NetworkManager keyfile directories.
Forward NetworkManager and systemd journal logs to a centralized log platform and retain them for forensic review.
Baseline normal VPN activation events per host so that abnormal CA-File content or new VPN profiles stand out.

How to Mitigate CVE-2026-91841

Immediate Actions Required

Apply the NetworkManager-vpnc package update from your Linux distribution as soon as it is available.
Audit existing NetworkManager connection profiles for CA-File values containing newlines or unexpected directives and remove any suspicious profiles.
Restrict which local users can create or modify system VPN connections through PolicyKit on multi-user hosts.

Patch Information

Refer to the Red Hat CVE-2026-91841 advisory and Red Hat Bug Report #2533651 for fixed package versions. Upstream remediation is tracked in the GNOME NetworkManager-vpnc Work Item. Install the patched NetworkManager-vpnc package through the distribution package manager and restart the NetworkManager service.

Workarounds

Uninstall or mask the NetworkManager-vpnc plugin on hosts that do not require vpnc-based VPN connectivity.
Tighten PolicyKit rules so that only administrators can call org.freedesktop.NetworkManager.settings.modify.system and settings.modify.own.
Enforce reviewed, read-only VPN connection profiles managed by configuration management rather than user-editable keyfiles.

bash

# Example PolicyKit rule restricting VPN connection modification to the wheel group
# File: /etc/polkit-1/rules.d/50-nm-vpnc-restrict.rules
polkit.addRule(function(action, subject) {
    if (action.id.indexOf("org.freedesktop.NetworkManager.settings.modify") === 0) {
        if (!subject.isInGroup("wheel")) {
            return polkit.Result.NO;
        }
    }
});